The AWS integration connects TigerTrust to your AWS account so it can enumerate certificates across ACM, IAM, and load balancer listeners. Once connected, discovered certificates land in your managed inventory alongside those from other sources. The same credentials can also be used for Route 53 DNS-01 challenges and AWS Private CA renewals.
Aws

​
What gets discovered

ACM certificates

Both Amazon-issued (auto-renew) and imported certificates across all commercial regions. Domain names, SANs, issuer, expiry, and the resources each certificate is attached to.

ALB / NLB / CLB

Load balancer listeners referencing ACM certificates, discovered through the in-use resource metadata on each ACM certificate.

IAM server certificates

Legacy IAM server certificates still used by CloudFront and older services.

KMS-backed keys

KMS customer-managed keys associated with certificate material.

​
Minimum IAM policy

Attach this policy to the IAM user or role whose credentials you give TigerTrust. It is strictly read-only. 
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "TigerTrustACMDiscovery",
      "Effect": "Allow",
      "Action": [
        "acm:ListCertificates",
        "acm:DescribeCertificate",
        "acm:GetCertificate",
        "acm:ListTagsForCertificate"
      ],
      "Resource": "*"
    },
    {
      "Sid": "TigerTrustIAMDiscovery",
      "Effect": "Allow",
      "Action": [
        "iam:ListServerCertificates",
        "iam:GetServerCertificate"
      ],
      "Resource": "*"
    },
    {
      "Sid": "TigerTrustELBDiscovery",
      "Effect": "Allow",
      "Action": [
        "elasticloadbalancing:DescribeLoadBalancers",
        "elasticloadbalancing:DescribeListeners",
        "elasticloadbalancing:DescribeListenerCertificates"
      ],
      "Resource": "*"
    },
    {
      "Sid": "TigerTrustKMSRead",
      "Effect": "Allow",
      "Action": [
        "kms:ListKeys",
        "kms:DescribeKey",
        "kms:ListAliases"
      ],
      "Resource": "*"
    }
  ]
}
For DNS-01 challenges through Route 53, add: 
{
  "Effect": "Allow",
  "Action": [
    "route53:ListHostedZones",
    "route53:GetHostedZone",
    "route53:ListResourceRecordSets",
    "route53:ChangeResourceRecordSets"
  ],
  "Resource": "*"
}
For renewals through AWS Private CA, add: 
{
  "Effect": "Allow",
  "Action": [
    "acm-pca:IssueCertificate",
    "acm-pca:GetCertificate",
    "acm-pca:DescribeCertificateAuthority"
  ],
  "Resource": "*"
}

​
Create the credentials

aws iam create-user --user-name tigertrust-discovery
aws iam put-user-policy \
  --user-name tigertrust-discovery \
  --policy-name TigerTrustPolicy \
  --policy-document file://tigertrust-policy.json
aws iam create-access-key --user-name tigertrust-discovery
Save the AccessKeyId and SecretAccessKey.

​
Connect from the product

1

Open the AWS integration

Go to Integrations > Cloud > AWS > Connect.
2

Enter credentials

Enter the account alias, access key ID, secret access key, and default region.
3

Test the connection

Click Test connection. TigerTrust calls acm:ListCertificates in us-east-1. A green result confirms permissions are correct.
4

Run initial discovery

Click Scan now or wait for the scheduled scan (default: every 6 hours). Results appear in Certificate Inventory tagged with the AWS source.

​
Regions scanned

TigerTrust scans the following commercial regions by default: 
us-east-1, us-east-2, us-west-1, us-west-2,
eu-west-1, eu-west-2, eu-west-3, eu-central-1,
ap-southeast-1, ap-southeast-2, ap-northeast-1, ap-northeast-2,
ap-south-1, ca-central-1, sa-east-1
GovCloud and China regions are not scanned by default. Contact support to enable additional regions.
Use IAM roles with instance profiles or IRSA in production rather than static access keys. Static keys should be rotated on a policy-defined schedule and stored in a secrets manager, not in TigerTrust’s configuration directly.

Route 53 for ACME

Use the same account for DNS-01 challenge automation.

Renewal automation

Route renewals through AWS Private CA.

Azure integration

Add Azure Key Vault and App Service.

GCP integration

Add Google Certificate Manager and GKE.